ucphhpc / migrid-sync

MiGrid workspace where master branch is kept strictly in sync with SF upstream svn repo. Any development or experiments should use a branch. You probably want to fork your own clone or work e.g. on the edge branch if you wish to contribute.
GNU General Public License v2.0
4 stars 4 forks source link

Improve UX for setting new password in webform #32

Open aputtu opened 12 months ago

aputtu commented 12 months ago

Some issues in user experience when setting password at https://sid.erda.dk/cgi-sid/reqoid.py :

  1. When signing up (test done as an external ERDA user), the webform checks whether password conforms to length, but not if characters are valid. User is only informed about invalid characters after pressing "Send" button, and input arguments gets rejected.
  2. When setting weak password, the form does not complain, but a pop-up message display on submit:

Please provide a valid and sufficiently strong password. I.e. 12 to 256 characters from at least 1 of the 4 different character classes: lowercase, uppercase, digits, other.

  1. Even when user is informed that password looks good, they may get told afterwards submitting, that password contains invalid characters.
  2. The error message displays less/greater than character (<>) in html.
  3. Double display of error message when passwords are identical is correct handling from server-side, but may confuse more than necessary, assuming non-identical passwords are given separate error message.

The error message:

input parsing error: password: ****************************************: found invalid character: u'$' (allowed: abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 -_#.,:;!@%/()[]{}+=?&lt;&gt;)

input parsing error: verifypassword: ****************************************: found invalid character: u'$' (allowed: abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 -_#.,:;!@%/()[]{}+=?&lt;&gt;)

Input arguments were rejected - not allowed for this script!

Steps to reproduce re: invalid characters:**

  1. Go to signup page and set password with illegal character, but otherwise conforming to webform criterias
  2. Click "Send" button

Steps to reproduce re: weak password

  1. Go to signup, fill out form, but use only "123"/"123" as passwords
  2. Click "Send" button

Suggestions for improving user experience:

Please provide a valid and sufficiently strong password. I.e. 12 to 256 characters from at least 1 of the 4 different character classes: lowercase, uppercase, digits, other.

jonasbardino commented 11 months ago

Thanks, valid points and suggestions. The validation on the form page is pure HTML5 using regular expression patterns, which makes it unrealistic to cover all corners for complete verification. E.g. checking for dictionary words or simple patterns like 12345678 will generally need the python backend. The input errors come from our standard safeinput validation helpers, which are unaware of the specific context.

In short, polish is possible but not trivial.

aputtu commented 5 months ago

Bug report in internal ticket #33041 points out that "<>" characters likely are using wrong encoding. The characters gets displayed incorrectly, when a password containing a non-allowed character gets rejected; displaying the allowed characters.

jonasbardino commented 5 months ago

True, everything in that string currently gets html-encoded to prevent illegal characters being injected in our html and potentially causing XSS attack vectors. Not sure how much work it would require to only encode the actual invalid char(s).